diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e5bf0a2..a5c60b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,21 +1,20 @@
 name: "Build"
 on:
   pull_request:
-    branches: ['**']
+    branches: ["**"]
   push:
-    branches: ['**']
-    tags: ['**']
+    branches: ["main"]
 jobs:
   ci:
     name: CI
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v20
-      - uses: cachix/cachix-action@v12
+      - uses: cachix/install-nix-action@v25
+      - uses: cachix/cachix-action@v14
         with:
           name: kubukoz
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       - name: Build (main)
         if: github.ref == 'refs/heads/main'
@@ -30,7 +29,7 @@ jobs:
 
       - name: Build (preview)
         if: github.event_name == 'pull_request'
-        run: ./build.sh '.?submodules=1#preview' && cp -Lr ./result public-preview
+        run: ./build.sh 'preview' && cp -Lr ./result public-preview
 
       - uses: JamesIves/github-pages-deploy-action@v4
         name: Deploy (preview)
diff --git a/build.sh b/build.sh
index a6d149d..25c49de 100755
--- a/build.sh
+++ b/build.sh
@@ -2,4 +2,5 @@
 
 PACKAGE_PATH="$1"
 
-nix build "${PACKAGE_PATH:-.?submodules=1}" --print-build-logs
+# shallow + there must be a hash: workaround for https://github.com/NixOS/nix/pull/10125
+nix build "git+file://$(pwd)/.?shallow=1&submodules=1#${PACKAGE_PATH:-default}" --print-build-logs
diff --git a/flake.lock b/flake.lock
index 5768ac8..9ecad51 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,12 +1,15 @@
 {
   "nodes": {
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
         "type": "github"
       },
       "original": {
@@ -17,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1675621301,
-        "narHash": "sha256-BukRB56a1TW8bWHJO4FY0rIK0LCl9xjvSMe+3QRznsw=",
+        "lastModified": 1709390518,
+        "narHash": "sha256-KTb7Zj0AX3esTWcyeGLeAaTg2JfDJD/bsgD8yI7Ehgc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "547f6ab7a24d4a6bb2793b573911188c7f8056e4",
+        "rev": "aaf58368e3748e22c1bb826fbdb907030f58a767",
         "type": "github"
       },
       "original": {
@@ -35,6 +38,21 @@
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",